Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Inputs.conf
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have this in my inputs.conf
_whitelist=(\.log|log$|^messages|^secure|mesg$|cron$|acpid$|\.out)
Can anyone help me understand what are the " ^ " and the " $ " are used for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These are known as anchors. They do not match any characters, they match a position. ^ matches at the start of the string, and $ matches at the end of the string.
Be careful though. In multiline strings, they can also match the beginning or end of a line and the ^ inside a square bracket can be used as a not as in [^a-z] which means not the characters a to z
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These are known as anchors. They do not match any characters, they match a position. ^ matches at the start of the string, and $ matches at the end of the string.
Be careful though. In multiline strings, they can also match the beginning or end of a line and the ^ inside a square bracket can be used as a not as in [^a-z] which means not the characters a to z
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes the top line will match the words "messages", "secure" or "auth" anywhere in the file or folder name. The bottom will only match if it is at the beginning of the source.
As most sources start with the drive or a slash (i.e. c:\ or /), it is unlikely to match those.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Bob,
I think I know what this is
can you tell me what the difference is in these two lines
whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)
_whitelist=(\.log|log$|^messages|^secure|mesg$|cron$|acpid$|\.out)
These are on two different systems and I am not getting the same logs from both
Should I take out the " ^ " symbol?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
